Low‑Privilege Reboot/Factory Reset in SICK TDC‑X401GL Controllers

An attacker with low privileges may be able to trigger critical system functions such as reboot or factory reset without proper restrictions, potentially leading to service disruption or loss of configuration.

Improper Input Handling Leading to Resource Exhaustion in SICK TDC-X401GL

Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service.

The application discloses all used components, versions and license information to unauthenticated actors, giving attackers the opportunity to target known security vulnerabilities of used components.

Unauthorized Access to Host Filesystem via TDC‑X401GL Vulnerability

An attacker may gain unauthorized access to the host filesystem, potentially allowing them to read and modify system data.

Unauthorized Application Control via Missing Authorization in SICK TDC-X401GL

Certain system functions may be accessed without proper authorization, allowing attackers to start, stop, or delete installed applications, potentially disrupting system operations.

Firmware Update Files Exposing Password Hashes Allow Credential Compromise

Firmware update files may expose password hashes for system accounts, which could allow a remote attacker to recover credentials and gain unauthorized access to the device.

Open Redirect in SICK AG TDC‑X401GL Login

Improper validation of a login parameter may allow attackers to redirect users to malicious websites after authentication. This can lead to various risk including stealing credentials from unsuspecting users.

Limited Permissions Permit File Write and System Manipulation

An attacker with limited permissions may still be able to write files to specific locations on the device, potentially leading to system manipulation.

Low Privilege File Disclosure via Directories in SICK TDC‑X401GL

An attacker with low privileges may be able to read files from specific directories on the device, potentially exposing sensitive information.

Missing Clickjacking Protection Allows Sensitive Data Extraction

An attacker may exploit missing protection against clickjacking by tricking users into performing unintended actions through maliciously crafted web pages, leading to the extraction of sensitive data.

Cross‑Site Scripting in Sick TDC‑X401GL Login Page

An attacker with administrative access may inject malicious content into the login page, potentially enabling cross-site scripting (XSS) attacks, leading to the extraction of sensitive data.

Token Leakage via URL Parameter Enabling Session Hijack

Certain requests pass the authentication token in the URL as string query parameter, making it vulnerable to theft through server logs, proxy logs and Referer headers, which could allow an attacker to hijack the user's session and gain unauthorized access.

Error Messages Reveal Sensitive System Details

Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attackers with valuable reconnaissance information (like file paths, database errors, or software versions) that can be used to map the application's internal structure and discover other, more critical vulnerabilities.

Weak CBC Cipher Suites Allow Possible Compromise of SSH Communication

An attacker may exploit the use of weak CBC-based cipher suites in the device’s SSH service to potentially observe or manipulate parts of the encrypted SSH communication, if they are able to intercept or interact with the network traffic.

Weak MAC Algorithms Compromise SSH Integrity on SICK LMS1000 and MRS1000

An attacker may exploit the use of outdated and weak MAC algorithms in the device’s SSH service to potentially compromise the integrity of the SSH session, allowing manipulation of transmitted data if the attacker can interact with the network traffic.

Vulnerability in SICK CLV6xx, SICK Lector6xx and SICK RFx6xx

A vulnerability in the .sdd file allows an attacker to read default passwords stored in plain text within the code. By exploiting these plaintext credentials, an attacker can log into affected SICK products as an “Authorized Client” if the customer has not changed the default password.

SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for pass-the-hash attacks

The product is vulnerable to pass-the-hash attacks in combination with hardcoded credentials of hidden user levels. This means that an attacker can log in with the hidden user levels and gain full access to the device.

SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for remote code execution

Due to missing input validation during one step of the firmware update process, the product is vulnerable to remote code execution. With network access and the user level ”Service”, an attacker can execute arbitrary system commands in the root user’s contexts.

SICK InspectorP61x and SICK InspectorP62x are vulnerable for firmware modification

Since the firmware update is not validated, an attacker can install modified firmware on the device. This has a high impact on the availabilty, integrity and confidentiality up to the complete compromise of the device.

SICK InspectorP61x and SICK InspectorP62x: missing authentication

Lua apps can be deployed, removed, started, reloaded or stopped without authorization via AppManager. This allows an attacker to remove legitimate apps creating a DoS attack, read and write files or load apps that use all features of the product available to a customer.